TFS does immediately not see group member changes.

11Sep

When adding a user to a windows/domain group (e.g. TFS-Users) that has access to a repository on Team Foundation Server it may be that this user does not get immediate access to your Team Collection. This is because Team Foundation Server caches the user that are present in the group TFS-Users. Therefore any user change on the windows/domain group, either removal or addition, will not be reflected immediately to the Team Foundation Service. The solution is to wait some amount of time, since Team Foundation Service will re-query the windows/domain user group for eligible users every hour.

Note: It does not work to shut down the IIS-Webpage and restart it, this will not force a re-query of the windows/domain group.